On 9 Dec 2008, at 04:24, bill hauck wrote:
So my question: is there an example application or best practice on
how to implement a check on all calls to see if the user should be
accessing a specific item? I guess this would apply to any type of
system: blog, auction, cms, etc. -- they all require checking if a
specific user can edit a specific item.
Assuming that you're using DBIx::Class, then the common way of doing
this would be to use ResultSet chaining to limit things.
What you do is add a 'limit_by_user' method (name is not important -
just pick one and stick to it for your entire app) on each ResultSet
class which you can pass $c->user, and have it return a filtered
result set..
You then arrange your controllers such that you will call this method
on all resultsets before actually searching them. The simplest
strategy is to just have code like:
$c->stash->{project} = $c->model('DB::Project')->limit_by_user($c-
>user)->find_by_foo($foo);
whenever you want to do a search.
This works well for simple cases. In more complex cases you can then
use any technique available to have the user filtering logic in one
place (and resultSet agnostic), and have it called from anywhere it
is needed - such as explicitly forwarding to an action to do the
filtering, or inheritance of a common path-part in all your
controllers (using Chained dispatch), or having a final set of
filtering before passing things to your templates in an 'end' action..
The trick is to use the fact you can say, $rs = $schema->resultSet
('Project'); $rs = $rs->search( # limit by criteria 1 ); $rs = $rs-
>search( # limit by criteria 2 ); etc, as many times as you need to
build up a complex search, and adding a common method to your
resultSet classes so that you can do the user filtering in one place.
Which technique to actually use to call into this common user-
filtering code is very much up to you (and varies depending on how
you have built your application / what type of app it is / what the
URL structure is like, etc), but most people would recommend looking
at Chained actions as they tend to naturally make this sort of thing
easy.
I hope that makes enough sense for you to have some ideas about where
to start without confusing you utterly!
Cheers
t0m
_______________________________________________
List: [email protected]
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/[email protected]/
Dev site: http://dev.catalyst.perl.org/
